From: Daniel Borkmann Date: Thu, 31 Jul 2014 19:48:59 +0000 (+0200) Subject: team: fix releasing uninitialized pointer to BPF prog X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=2b391ee2cae3945832011970bede35dab885879d;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git team: fix releasing uninitialized pointer to BPF prog Commit 34c5bd66e5ed introduced the possibility that an uninitialized pointer on the stack (orig_fp) can call into sk_unattached_filter_destroy() when its value is non NULL. Before that commit orig_fp was only destroyed in the same block where it was assigned a valid BPF prog before. Fix it up by initializing it to NULL. Fixes: 34c5bd66e5ed ("net: filter: don't release unattached filter through call_rcu()") Signed-off-by: Daniel Borkmann Cc: Pablo Neira Cc: Alexei Starovoitov Cc: Jiri Pirko Signed-off-by: David S. Miller --- diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c index 7106f3456439..d7be9b36bce6 100644 --- a/drivers/net/team/team_mode_loadbalance.c +++ b/drivers/net/team/team_mode_loadbalance.c @@ -272,7 +272,7 @@ static int lb_bpf_func_set(struct team *team, struct team_gsetter_ctx *ctx) { struct lb_priv *lb_priv = get_lb_priv(team); struct sk_filter *fp = NULL; - struct sk_filter *orig_fp; + struct sk_filter *orig_fp = NULL; struct sock_fprog_kern *fprog = NULL; int err;